from lib.cuckoo.common.abstracts import Signature
import re


class TestReg(Signature):
    name = "test_reg"
    description = "Attempts to traverse the keys and subkeys under the specified registry key."
    severity = 3
    categories = ["reg"]
    authors = ["xuhy"]
    minimum = "2.0"

    regkeys_re = [
        ".*\\\\(SOFTWARE|Software)\\\\(Wow6432Node\\\\|WOW6432Node\\\\)?Microsoft\\\\.NETFramework\\\\.*",
    ]

    # filter_apinames = [
    #     "RegEnumKey",
    #     "RegEnumKeyEx",
    #     "RegEnumValue",
    #     "RegOpenKey",
    #     "RegOpenKeyEx",
    #     "RegQueryInfoKey",
    #     "RegQueryValue",
    #     "RegQueryValueEx",
    # ]

    def on_complete(self):
        for process in self.get_results("behavior", {}).get("generic", []):
            print('process---', process.get("summary", {}))
        for indicator in self.regkeys_re:
            for regkey in self.check_key(pattern=indicator, regex=True, all=True):
                self.mark_ioc("registry", regkey)
                self.severity += 1
        if self.severity > 6:
            self.severity = 6
        return self.has_marks()
